sourcecode 4.2.0__py3-none-any.whl → 4.3.0__py3-none-any.whl

sourcecode/verify_repo.py

@@ -145,11 +145,20 @@ def _head_sha(root: Path) -> str:
     return (r.stdout or "").strip() if r.returncode == 0 else ""
 
 
-def evaluate_repo(root: Path) -> "tuple[list[Any], Optional[Path], int]":
+def evaluate_repo(
+    root: Path, *, on_cir: "Optional[Any]" = None
+) -> "tuple[list[Any], Optional[Path], int]":
     """(violations, contracts file, contract count) for the tree as it stands.
 
     Raises VerifyError when the contracts cannot be read or the repository
     cannot be analysed — the caller reports `unverified`.
+
+    `on_cir` is handed the IR this gate builds, once, before the contracts are
+    evaluated. It exists so that work which needs the same IR — capturing the
+    architectural baseline of this commit — rides along with the run instead of
+    paying for a second analysis. It is a side channel by design: whatever it
+    does cannot change the verdict, and an exception inside it is swallowed,
+    because the gate's answer is about contracts and nothing else.
     """
     from sourcecode.verify_edit import _build_cir
     from sourcecode.verify_rules import RulesError, evaluate_all, load_rules, rules_path
@@ -165,6 +174,11 @@ def evaluate_repo(root: Path) -> "tuple[list[Any], Optional[Path], int]":
         cir = _build_cir(root)
     except Exception as exc:  # analysis failure is never a pass
         raise VerifyError(f"could not analyse {root}: {exc}") from exc
+    if on_cir is not None:
+        try:
+            on_cir(cir)
+        except Exception:  # noqa: BLE001 — a passenger never crashes the gate
+            pass
     return evaluate_all(rules, cir), path, len(rules)
 
 
@@ -173,6 +187,7 @@ def verify_repo(
     *,
     fail_on: str = "new",
     baseline_path: "Optional[Path]" = None,
+    on_cir: "Optional[Any]" = None,
 ) -> VerifyReport:
     """Check the repository against its declared contracts."""
     if fail_on not in FAIL_ON_CHOICES:
@@ -184,7 +199,7 @@ def verify_repo(
     resolved_baseline = Path(baseline_path) if baseline_path else (root / DEFAULT_BASELINE)
 
     try:
-        violations, contracts_file, contract_count = evaluate_repo(root)
+        violations, contracts_file, contract_count = evaluate_repo(root, on_cir=on_cir)
         baselined_keys = load_baseline(resolved_baseline)
     except VerifyError as exc:
         return VerifyReport(

{sourcecode-4.2.0.dist-info → sourcecode-4.3.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.2.0
+Version: 4.3.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -160,8 +160,8 @@ ask verify /path/to/repo --init
 # writes nothing — the form an audit of somebody else's repository can run.
 ask verify /path/to/repo --init --dry-run
 
-# What each defect actually costs once reach, access and write effect are in it:
-# severity × reachability × auth_verdict × write_effect, ordered, every factor traceable.
+# What each defect actually costs once reach, access, write effect and the shape of
+# the input path are in it — ordered, every factor traceable to the command that owns it.
 ask risk /path/to/repo
 ```
 
@@ -254,12 +254,16 @@ guesses is a confident security falsehood — the worst failure mode this tool h
 ### 5c · Composed Risk *(experimental)*
 Every command above answers one axis, and a reader composes them by hand. `ask risk` does the
 join over the endpoint and symbol ids these commands already share with each other:
-`severity_effective = defect_severity × reachability × auth_verdict × write_effect`. The
-product of the published factors **is** the published score — decomposable to the four
+`severity_effective = defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`. The
+product of the published factors **is** the published score — decomposable to the six
 figures and the authority behind each — and an axis this build cannot measure is `unknown`,
 weighted 1.0 and named in `blind_axes` rather than silently treated as safe. Measured on a
 field case: a defect both `spring-audit` and `impact-chain` called *medium* composes to
 **high (8.06)** once *reachable unauthenticated* and *writes to the database* are in it.
+The last two factors describe the input path — a query assembled by concatenation, a route
+accepting a body with no declared constraint. They are **adjacencies, not dataflow**: no
+value is followed from a request to a sink, which is `NC-001` and is published in the
+payload's own `non_coverage` block.
 `ask risk .` · `ask risk . --min-band high` · `ask risk . --limit 10`
 → [reference](docs/USER_GUIDE.md)
 
@@ -285,7 +289,7 @@ experimental: both are true, and they are two different facts.
 |---|---|---|
 | **core** | contract stable within a major — safe to gate CI on | `endpoints` · `spring-audit` · `migrate-check` · `impact` · `impact-chain` · `pr-impact` · `verify` |
 | **supported** | maintained; fields are added, never removed without a major | every command not named in another row |
-| **experimental** | shape may change in a minor — do not gate CI on it | `risk` · `posture` · `archetype` |
+| **experimental** | shape may change in a minor — do not gate CI on it | `risk` · `enrich` · `data-exposure` · `migrate-recipe` · `posture` · `archetype` |
 | **parked** | kept working, no longer developed | `retrieve` |
 
 The same table is printed by `ask --help`, and both are generated from one authority
@@ -302,7 +306,10 @@ from it.
 | Command | Tier | Answers | Note |
 |---|---|---|---|
 | `posture` | experimental | which beans a profile set wires, and how effective endpoint access differs between two sets | the most differentiated capability here |
-| `risk` | experimental | what each defect actually costs, once reach, access and write effect are in it | `defect_severity × reachability × auth_verdict × write_effect`; every factor names its authority |
+| `risk` | experimental | what each defect actually costs, once reach, access, write effect and the shape of the input path are in it | `defect_severity × reachability × auth_verdict × write_effect × query_construction × input_constraints`; every factor names its authority |
+| `enrich` | experimental | another scanner's SARIF findings, ranked by what this repository does with them | `--sarif <log>`; the same composition as `risk`, with the scanner as the severity authority |
+| `migrate-recipe` | experimental | the migration report as the OpenRewrite recipe that applies it | only recipes a finding named; the manual remainder published beside them; writes nothing without `--write`, and never a runnable command for an empty recipe list |
+| `data-exposure` | experimental | which routes can carry the data you labelled, and who reaches them | labels declared in `sourcecode.config.json` — never inferred from a name; `signature` and `call_reach` evidence published apart, field-level flow out of scope (NC-008) |
 | `endpoints` | core | every REST endpoint, effective path, security policy, confidence | Spring MVC + JAX-RS (~65 % recall on JAX-RS sub-resource locators) |
 | `spring-audit` | core | transactional anomalies + security surface + validation gaps | `--ci`, `-f github-comment` |
 | `migrate-check` | core | Boot 2→3 readiness: located blockers, per-dimension score, effort | `--blast-radius` orders the re-test plan |
@@ -317,7 +324,7 @@ from it.
 | `review-pr` / `fix-bug` / `prepare-context` | supported | diff review, symptom triage, task-shaped context | |
 | `plan` / `compare` / `delta` / `contract-diff` | supported | what to review for a change; candidates by measured cost; outcome of a change; public-contract break | no verdicts, measured cost only |
 | `validation` | supported | request-body validation coverage and gaps | |
-| `baseline capture\|diff` · `trend` | supported | versioned architectural metrics over time; `ask trend <dir>` reads the series | trend reporting, not gating. Baselines land in `.ask/baselines` **inside the repository** — the history travels with the code, not with a vendor; an audit that must not write passes `--dir`. Automate it: [baseline-ci.yml](docs/baseline-ci.yml) |
+| `baseline capture\|diff` · `trend` | supported | versioned architectural metrics over time; `ask trend .` reads the series (a repository path or a baselines directory), `ask baseline diff .` compares the tree against its newest point | trend reporting, not gating. Baselines land in `.ask/baselines` **inside the repository** — the history travels with the code, not with a vendor; an audit that must not write passes `--dir`. `capture --auto` is the unattended form (one baseline per commit, never rewrites one, never fails the build) — automate it: [baseline-ci.yml](docs/baseline-ci.yml) |
 | `retrieve` | parked | typed knowledge queries over the model | |
 | `archetype` | experimental | evidence-based architectural archetype | |
 | `rename-class` / `chunk-file` | supported | word-boundary Java rename; split a large file for an agent | |
@@ -368,6 +375,18 @@ And one about the endpoint surface itself:
 |---|---|---|
 | **HTTP surface that is not a Spring handler mapping — a servlet declared in `web.xml` or registered as a `ServletRegistrationBean`, a container-level mapping, a static console mounted by a library.** | The endpoint population is projected from the Spring route model: one entry per handler mapping. A servlet is reachable over HTTP and is not in that model, so it is absent from `endpoints`, from the access verdicts derived from it, and from every ratio keyed on the total. Merging a second population into that count would move a published figure and every ratio with it, so the population is declared before it is widened. | Read the deployment descriptors for `<servlet-mapping>` entries and the Spring configuration for `ServletRegistrationBean` beans. Field evaluation #9 found a monitoring console mounted this way, behind a credential `ask spring-audit` did report (SEC-007) at a path nothing here listed. |
 
+And one about labelled data:
+
+| Not covered | Why | What answers it |
+|---|---|---|
+| **Whether a labelled member actually leaves the process on a given route — field-level dataflow through mappers, DTOs, serializers and projections.** | Exposure here is measured at TYPE granularity over the same call reach every other command walks: a route reaches the labelled type, or its signature names it. Whether the mapping in between keeps the labelled member is a dataflow question, and answering it by approximation would put a confident `no` on a route that does leak. So `call_reach` is published as a supremum and says so. | Read the mapping on the routes this answer ranks first — they are the ones worth a human — and label the DTO too if it carries the member, which makes the route `signature` instead of `call_reach`. |
+
+And one about who calls a route:
+
+| Not covered | Why | What answers it |
+|---|---|---|
+| **Whether a route is called from outside this repository — another service, a mobile app, a partner, a cron job, or a client whose URL is assembled at run time.** | The join reads the TypeScript/JavaScript checked in beside the server and only the call shapes whose verb and path are written at the call site. That is a floor on who calls a route and can never be a ceiling: the repository cannot observe consumers it does not contain. So a route with no call site here is published as a candidate for deletion, never as dead API. | Access logs or an API gateway answer who really calls a route. The opposite direction is decisive without them: a client call matching no route is a request this repository's own front end makes and its server does not serve. |
+
 **Positioning.** Until an executor ships, this is the **diagnosis layer**: it measures what
 must change, what each change reaches, and what a gate should block — and it removes none of
 it. Field evaluation scored it 7/10 as a report generator and 5.5/10 as a development tool,

{sourcecode-4.2.0.dist-info → sourcecode-4.3.0.dist-info}/RECORD

@@ -1,13 +1,14 @@
-sourcecode/__init__.py,sha256=EFb1wf7RVjVZuSeBJuZWIx9FLFTExu1Z6pm2th-GIUg,308
+sourcecode/__init__.py,sha256=VzE3y83kXkJoA93WrV4CYV_6qTGSQOQGTFSYee-Wiz8,308
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/archetype.py,sha256=HBGTTaS-bVHS6pdacPUMKcMxklkDEKnZMgz48Kc3yec,37630
-sourcecode/architectural_baseline.py,sha256=7QzJri4pbL3nzAn9gNutZW6mZR8HHD6H2C2H1EEwYPE,17904
+sourcecode/architectural_baseline.py,sha256=agDSwGEakdkgLLh5xnd3hiD_TC6pRujWt4klnuYF1wo,18689
 sourcecode/architectural_delta.py,sha256=E6MkyjWl-1ZgR4KSKnI785gUAfc8nq-lK-jd_rupQBU,12496
 sourcecode/architecture_analyzer.py,sha256=GFc4ek-s1IHWM7pl-0L32WahZ93AmDgrAMcOuBKA5Dk,61463
 sourcecode/architecture_summary.py,sha256=BVVRHd952cjRhjHnR6CPrvKgaa-tdM16l-pBi1yDCPs,32395
 sourcecode/ast_extractor.py,sha256=ZwHN3Y0iRp2gpv3t5Nm5uvX7Xw1KtULCJPZqKpZQRAE,51255
+sourcecode/baseline_autocapture.py,sha256=xxfXT9Nu4uiDbWMZRawcCXsA4fjgEjZW2qI173dq3GE,14962
 sourcecode/cache.py,sha256=Es9ZLqGRoheMv2bOD1azaFKqU2zJKJVudHhjQKcIxy8,40128
-sourcecode/cache_model.py,sha256=c6upV6sENXypx9ik01eTsMWNkz5ZYZr4jPWL2Sa_8pQ,15941
+sourcecode/cache_model.py,sha256=hUGWNKBKLV76mGveFffOzr9fqFD1ZydJVakseRsg14s,17401
 sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,4148
 sourcecode/caller_metrics.py,sha256=--sFGDnIog_YGu9xZHMcB91F5xZakfaAKvy15xU54hg,7904
 sourcecode/caller_reach.py,sha256=RRF49tv4-QswraJ2vsZ89VAMOj7BmYXlAdXr-tLP_CA,9483
@@ -16,13 +17,14 @@ sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,127
 sourcecode/change_plan.py,sha256=kFjjp16XYbupgkv1CPkfqo39_SiZPMRQ8OOfC-Vy9eg,7929
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=ZlwBZ_vpb3G2nuAlWyPW2JWlXzDsc1u4MejlDb0_iRM,460367
+sourcecode/cli.py,sha256=1iYGmrAvmN3lW1gWL3xVLo-tTj2VR92Sqa_k7rmuejA,482834
+sourcecode/client_calls.py,sha256=fb5fvmryrBQlly2ETyLcjoQcyzQTPxZ38jYx47V_yqs,13293
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=xq3zsqAOAw4AWkoD9khb9xDP_O3KvwqO9k-pf8sbi3g,10951
 sourcecode/confidence_analyzer.py,sha256=5li0NyOdS3Ie-f2ZY1gBmnjtkuRvI50l4OnGaKkXAOU,22358
 sourcecode/constraint_diff.py,sha256=hWIO5vsxvHjsgQx23K3r_JMy1W6wQ2Ca4DqB9R_iMnY,5831
 sourcecode/context_cache.py,sha256=VCH-u6wPrTv6fz5uGqqwsLaVEUKVyZZSOhkb0BmZ6cA,26297
-sourcecode/context_graph.py,sha256=i2kOX3XiaCqcR20ojbUnqoX-hJbMyLNYc7rl-n15bwE,46426
+sourcecode/context_graph.py,sha256=UBUW97DnJe5hGgCI-JohgKWDfKTszBuL3DIxQylVZQE,47034
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
 sourcecode/context_summarizer.py,sha256=cI2TZMvEhl0BEma12VtPaX6z03ZVBAetVzuK5GaCOvg,6852
 sourcecode/contract_diff.py,sha256=ivgHL1qRKFhriwQ52KWj4oJselqd5icSJW7Z2Ke04po,9429
@@ -30,12 +32,14 @@ sourcecode/contract_init.py,sha256=MBzhrgCVfJRXsMYNe8k5cwxdDGcz4pZpIaJhieQTvmk,1
 sourcecode/contract_model.py,sha256=nRxJKPMs1VHwFTa8AVXhGmaLjti3Lr2sjHDpWgv1bfE,3917
 sourcecode/contract_pipeline.py,sha256=4XE-xhab7ysdExXyUOBl2hAH4MABo7moKnT9V4XcEwQ,30243
 sourcecode/coverage_parser.py,sha256=X9scuUWxacahYTrTBGea2Ku-sf-WCVcnc9OEB35_3IU,19340
+sourcecode/data_exposure.py,sha256=NWavzz8tvsI_3QF9IulJdFQYNV_Z07QLWcBJSGduuN4,13768
+sourcecode/data_labels.py,sha256=IF8xedY0uPFefpDpOSYrb1ita_XoyjPctlXTXAMe4pc,7230
 sourcecode/defect_identity.py,sha256=XS2VFDImg9NLaRImybKTeyk-CoDSsXmchldg0dwvM7c,7028
 sourcecode/degradation.py,sha256=BtuGUKFgkzI3Z6fwmUdxEUEaLFAcPQ_bHhU2w9ItDxw,18376
 sourcecode/dependency_analyzer.py,sha256=fQCaWQ7_BNcVgZv8gweJCwJ1CGlXsz8nw_tqN3aHJNE,63952
 sourcecode/deployment_prefix.py,sha256=g0_4bE_m9svjhnapRpOp8BJkj6Ul94Ij_iVezygMZ0I,11956
 sourcecode/doc_analyzer.py,sha256=05bjTUbDbmnbajD_cgRnACzS8T7xxBKVX4CjkJlhZg8,24411
-sourcecode/dynamic_argument_surface.py,sha256=iRzrJhs57UXrGvLhNPiTA-e_sdO6ka-wNqc0wIiegiM,2554
+sourcecode/dynamic_argument_surface.py,sha256=u6zJoY-zChYVw1-SrgiyAq-rUwqMZ5ZqBwLfbPJ_8ng,2960
 sourcecode/endpoint_literals.py,sha256=Qf4gTZzvNSFDGDuOvF0YRL9NvaYKKj24klhR5LIOaXc,3263
 sourcecode/endpoint_metrics.py,sha256=sLSLUIgiIyvNdOynaxVgHd9SjRF_DbN3QxevaquykaU,2840
 sourcecode/entrypoint_classifier.py,sha256=jhTYlyqDJH2AtdEcLVaRU3lYRTJuF8DkxVzl4-W3zWE,5322
@@ -48,7 +52,7 @@ sourcecode/explain.py,sha256=8i1gQL8qNUO6NuUmzgO4vYdGGBn5_lp-1XqI9LPyx2k,25271
 sourcecode/file_chunker.py,sha256=3vkM3mDQ5eE_yTPvUgjyjpGFBIjkW6_mrBmIbrylnA8,16444
 sourcecode/file_classifier.py,sha256=pJCeN9KqWpAwKMCgGP4KDsBjuWMeo4zlbj5fv3hk9dA,15587
 sourcecode/filter_surface.py,sha256=HeV1qU0y_UO95KNTy3Xb551zXvv7_ns2gyxCS5uC3fs,16418
-sourcecode/format_contract.py,sha256=CB1esEH5EfUtUqreNZc9NqGBoUTxs7sWwS7kiN5_G38,4022
+sourcecode/format_contract.py,sha256=nXohGRzH3GO5HdvPQTc4ZioomN_N8XQ8Px0GZXrMf_I,4062
 sourcecode/fqn_utils.py,sha256=XLU7zDkNBXz_RZkIUNfpPmp1nekWtqP-fxV92tDV1vg,2158
 sourcecode/git_analyzer.py,sha256=irvEwddbd5_tbA_eYUZebf4mH7_nFhpjwaWAV1f7jUY,15755
 sourcecode/git_checkout.py,sha256=gCnkMwHpU6yLyc10FoGzE8W9-tI8KyYxKTgpbWPjayo,6009
@@ -63,15 +67,16 @@ sourcecode/mcp_nudge.py,sha256=lKemOqK_wny2u7Ymcr2Idi5Kx8pXY02jCi-_nJYLGMg,2992
 sourcecode/metrics_analyzer.py,sha256=gLoRWKygF18jLgwsqmGXSWopw-f5iO1VbM7Jjdif6ag,22809
 sourcecode/migrate_check.py,sha256=jMv1GMhMthpHCnoEtkKWHiIC2Not2kdbU4UaA9sWX7I,134643
 sourcecode/migration_blast.py,sha256=OPryWkM6-PbvcG3eJFdcWUnlpXBje41nu2BkrZnE2hg,9359
-sourcecode/non_coverage.py,sha256=STfnE086oXPbRgcr9NdBVeHjMaqw_yABPYnHqvk_wnA,9529
+sourcecode/non_coverage.py,sha256=W2q9-T6wXwCuKK2nVrcJ1lRVqzIKWDQtIZworGdFI_c,11715
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
+sourcecode/openrewrite_recipe.py,sha256=4dyY5twRB6Xew-G9Zy5FafNZwlMU1S7DnRa2FqPkhpQ,12233
 sourcecode/output_budget.py,sha256=__DQrIg7MGsYrd0_S3lyd3AG0a0jWNGr55v5Gg9kK0U,12347
 sourcecode/parse_cache.py,sha256=SnHOhNTvAqHm_PXImPVBuj7NEoOQRn8dfIZHEqOFENs,7565
 sourcecode/path_admission.py,sha256=OGNSoluhVh8YYOBZBnACUrkmH4Tp_yxjGLifkcsxQpo,5838
 sourcecode/path_filters.py,sha256=qPKO7kRmVp2y9zjLNSuAVCbcpZrIInHE4QulLUlzPFI,10412
 sourcecode/perf.py,sha256=GAcEoouPIlPMCQIcHNToxK6K3WdIR-lj9aFg4prOYJI,9743
 sourcecode/pipe_contract.py,sha256=PML0Er5d8uDyec4OrdUXuyqHbGPUYndjeaKUjkFz2u4,8369
-sourcecode/posture.py,sha256=pqrCtvxmupB6_K5OXMn-8kqco_eNCRe7sazKDcO190Q,71763
+sourcecode/posture.py,sha256=x1LY98XSjZzG4xThZYJYK3e5BTYDmJhyg5eqJ5KquNk,72999
 sourcecode/pr_comment_renderer.py,sha256=239PmJdf95av_ZW236C7_tvq_ahECeuF9AZxrheJ4OQ,15573
 sourcecode/pr_impact.py,sha256=eaFgcPMDsjaF8VZvcitFWCPCabMTi-khtGdxpK0wXTQ,22461
 sourcecode/prepare_context.py,sha256=B8TiBQbazxUOz6D37Dt9zqbOtD5b2S_fR3MB15P9DrI,237206
@@ -86,11 +91,12 @@ sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcr
 sourcecode/remedies.py,sha256=-zvOeVllMqhSVT3BzXmSLDwDNrPEv-VJsEzNtMKJ4WI,5034
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=t4RSLn00mkru5p54KXsT3tmG78FjXKNFDMl2YR-jLiM,355314
+sourcecode/repository_ir.py,sha256=uuJsPmtgSEi4MKVKJEiZl8bpvU1QFU2Oslxn96p5xi8,356849
 sourcecode/ris.py,sha256=Xin3d3U43-VthgRA6ttJnyIow8iyUEsQCBENvZc4eEc,23782
-sourcecode/risk.py,sha256=yrtKAO77XrKUFnqs-1_3ttKqLGFNcBIHZOTYSnj0Igo,17892
+sourcecode/risk.py,sha256=cgkHu4fjAyLs9xSytegdv4b8ua8RqRJEQ5rHbQKgzfo,34851
 sourcecode/rule_catalog.py,sha256=buU6qZI1j1EjqAWOIzeDhZ9kO_6Tp_Ma-dmexNWkMe0,4324
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
+sourcecode/sarif.py,sha256=_3ggbtV0O2iK5zeUiJSS36KxpPRVAtGy0hzXAFBmww8,25590
 sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_config.py,sha256=KblMEoRiEjrIE68YsPaUAFebxFp8UM7MS7lAk5CGD8U,3531
@@ -117,10 +123,10 @@ sourcecode/test_sources.py,sha256=2O7LXF-M-CQ0DwEF3B7BfWE6IWmHJngSOES5aRz6WR4,62
 sourcecode/token_estimate.py,sha256=RBXCGnF20jMzAeU0rUuf22Ol6y2wdf9q6nfs2sXIn4k,9262
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/type_usage_surface.py,sha256=51IrKRQoIoRnlsiDjHnqpJBn2rc6E59aRhgS0HTzAF0,4428
-sourcecode/validation_inference.py,sha256=yd2TSuh-hhdF0vdBB63ffkbPn1vEUp896K2tAKkNogM,19508
+sourcecode/validation_inference.py,sha256=-oWJqE6PqkqcZbCFDJeWCQHgI9Dbuv5ggJWD3LE_2IU,20817
 sourcecode/validation_surface.py,sha256=jYL-hkDjaaRKkAt7ZUcbxm3Dydl8o6KVRhTkuPXKPVc,31460
 sourcecode/verify_edit.py,sha256=FPvHmHQd0cUBAZE9smy9HGpNeH9BwAITPUKBBxyUXdk,35943
-sourcecode/verify_repo.py,sha256=ERvIwhLw-zV53BMEw7Zqo6X4cDsFJXQcWTNjsYNjvRE,11352
+sourcecode/verify_repo.py,sha256=GRdw3vHHcuDD7JTW_dmLRmp93oyv8FH1yNa-ukBRjdc,12070
 sourcecode/verify_rules.py,sha256=vX0YADEI78J8-tjRTtRhe2pZP0x7K_qvS1EypuqD3KQ,18011
 sourcecode/version_check.py,sha256=CHp6ZxTIfo8kyHPCBgJA1uFC0xQCoXMuuOfrW8QTL8o,4942
 sourcecode/workspace.py,sha256=X_6NmNnitvT3_38V-JDChydo_sR68s249hLFlrQskU0,8271
@@ -182,8 +188,8 @@ sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-4.2.0.dist-info/METADATA,sha256=91ZFju2Lqmbn7MjBx8HW3NpipglLYoWt__EGyQgilmw,29930
-sourcecode-4.2.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-4.2.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-4.2.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-4.2.0.dist-info/RECORD,,
+sourcecode-4.3.0.dist-info/METADATA,sha256=T75swzEAj9oh9i0jR206k-oOMYRnilGJS2qlTY5gcgY,33052
+sourcecode-4.3.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-4.3.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-4.3.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-4.3.0.dist-info/RECORD,,